https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 30 Oct 2026 13:36:59 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-118664 <p>decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in index.js falls back to customDecodeURIComponent after native decoding throws, and the fallback collects every distinct percent-encoded run before performing a full-string regular-expression replacement for each entry. Malformed input containing many distinct runs can therefore make both the number of replacements and the scanned input length grow together, causing quadratic CPU consumption and blocking the Node.js event loop; request-body inputs can reach the demonstrated size, while ordinary URL header limits reduce the practical delay. This issue is fixed in version 0.5.1.</p> <p>decode-uri-component provides a more robust alternative to decodeURIComponent. Prior to 0.5.1, decodeUriComponent in index.js falls back to customDecodeURIComponent after native decoding throws, and the fallback collects every distinct percent-encoded run before performing a full-string regular-expression replacement for each entry. Malformed input containing many distinct runs can therefore make both the number of replacements and the scanned input length grow together, causing quadratic CPU consumption and blocking the Node.js event loop; request-body inputs can reach the demonstrated size, while ordinary URL header limits reduce the practical delay. This issue is fixed in version 0.5.1.</p> https://db.gcve.eu/vuln/fkie_cve-2026-118664 https://db.gcve.eu/vuln/ghsa-qr28-fpjm-wq7f <p><strong>Affected:</strong> npm: decode-uri-component</p> <p>### Summary</p> <p>`decodeUriComponent()` takes quadratic time on malformed input that has many distinct percent-encoded runs. A single unauthenticated request of about 224 KB can block the Node.js event loop for about 20 seconds. Version 0.5.0, the release that fixed CVE-2026-45822, is affected.</p> <p>### Details</p> <p>When native decodeURIComponent throws, `decodeUriComponent()` falls back to `customDecodeURIComponent` (`index.js:122`). That function: 1. Scans the input for every run of percent-encoded bytes (e.g. `%C3%A5`) and stores each distinct run, with its decoded value, in a lookup table (`index.js:130-144`). 2. Runs one full-string `input.replace(new RegExp(key, &#39;g&#39;), …)` per table entry (`index.js:154`).</p> <p>With K distinct runs in an input of length L, that&#39;s K regex compilations and K full scans of the string, so O(K·L). An attacker controls both K and L, and K grows with L. One malformed sequence such as a trailing `%zz` is enough to force the fallback path.</p> <p>The 0.5.0 fix for CVE-2026-45822 (`fa479da`) replaced the recursive `decode()` routine with a linear scanner, but left this replacement loop unchanged.</p> <p>### Proof of concept</p> <p>Running the following code takes ~20 seconds.</p> <p>```js import decodeUriComponent from &#39;decode-uri-component&#39;;</p> <p>let payload = &#39;&#39;; for (let i = 0; i &lt; 32000; i++) { const high = Math.floor(i / 256).toString(16).padStart(2, &#39;0&#39;); const low = (i % 256).toString(16).padStart(2, &#39;0&#39;); payload += `%${high}%${low}x`; // distinct run each iteration } payload +=…</p> <p><strong>Affected:</strong> npm: decode-uri-component</p> <p>### Summary</p> <p>`decodeUriComponent()` takes quadratic time on malformed input that has many distinct percent-encoded runs. A single unauthenticated request of about 224 KB can block the Node.js event loop for about 20 seconds. Version 0.5.0, the release that fixed CVE-2026-45822, is affected.</p> <p>### Details</p> <p>When native decodeURIComponent throws, `decodeUriComponent()` falls back to `customDecodeURIComponent` (`index.js:122`). That function: 1. Scans the input for every run of percent-encoded bytes (e.g. `%C3%A5`) and stores each distinct run, with its decoded value, in a lookup table (`index.js:130-144`). 2. Runs one full-string `input.replace(new RegExp(key, &#39;g&#39;), …)` per table entry (`index.js:154`).</p> <p>With K distinct runs in an input of length L, that&#39;s K regex compilations and K full scans of the string, so O(K·L). An attacker controls both K and L, and K grows with L. One malformed sequence such as a trailing `%zz` is enough to force the fallback path.</p> <p>The 0.5.0 fix for CVE-2026-45822 (`fa479da`) replaced the recursive `decode()` routine with a linear scanner, but left this replacement loop unchanged.</p> <p>### Proof of concept</p> <p>Running the following code takes ~20 seconds.</p> <p>```js import decodeUriComponent from &#39;decode-uri-component&#39;;</p> <p>let payload = &#39;&#39;; for (let i = 0; i &lt; 32000; i++) { const high = Math.floor(i / 256).toString(16).padStart(2, &#39;0&#39;); const low = (i % 256).toString(16).padStart(2, &#39;0&#39;); payload += `%${high}%${low}x`; // distinct run each iteration } payload +=…</p> https://db.gcve.eu/vuln/ghsa-qr28-fpjm-wq7f